781272 - crash in nsRootPresContext::RequestUpdatePluginGeometry

Status: RESOLVED DUPLICATE of bug 781265

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It first appeared in 17.0a1/20120808 and is currently #2 top crasher in today's build. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1bbc0b65dffb&tochange=e55638d4037a

Signature 	nsRootPresContext::RequestUpdatePluginGeometry(nsIFrame*) More Reports Search
UUID	e3d62ece-1ae3-45e6-896c-29afd2120808
Date Processed	2012-08-08 18:00:09
Uptime	506
Last Crash	11.0 minutes before submission
Install Age	22.2 minutes since version was first installed.
Install Time	2012-08-08 17:37:32
Product	Firefox
Version	17.0a1
Build ID	20120808030529
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7600
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 37 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x1c
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0046, AdapterSubsysID: 04661028, AdapterDriverVersion: 8.15.10.2104
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x0046
Total Virtual Memory	4294836224
Available Virtual Memory	3862122496
System Memory Use Percentage	40
Available Page File	6251466752
Available Physical Memory	2428760064

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsRootPresContext::RequestUpdatePluginGeometry 	layout/base/nsPresContext.cpp:2777
1 	xul.dll 	PresShell::DoReflow 	layout/base/nsPresShell.cpp:7532
2 	xul.dll 	PresShell::ProcessReflowCommands 	layout/base/nsPresShell.cpp:7608
3 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:3877
4 	xul.dll 	nsEventStateManager::FlushPendingEvents 	content/events/src/nsEventStateManager.cpp:4958
5 	xul.dll 	nsEventStateManager::PreHandleEvent 	content/events/src/nsEventStateManager.cpp:1140
6 	xul.dll 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6456
7 	xul.dll 	PresShell::HandlePositionedEvent 	layout/base/nsPresShell.cpp:6207
8 	xul.dll 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6004
9 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:858
10 	xul.dll 	PresShell::DispatchSynthMouseMove 	layout/base/nsPresShell.cpp:3420
11 	xul.dll 	PresShell::ProcessSynthMouseMoveEvent 	layout/base/nsPresShell.cpp:5203
12 	xul.dll 	PresShell::nsSynthMouseMoveEvent::WillRefresh 	layout/base/nsPresShell.h:621
13 	xul.dll 	nsRefreshDriver::Notify 	layout/base/nsRefreshDriver.cpp:339
14 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:476
15 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:624
16 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:82
17 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
18 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
19 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
20 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:232
21 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:271
22 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3798
23 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3875
24 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3951
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsRootPresContext%3A%3ARequestUpdatePluginGeometry%28nsIFrame*%29
https://crash-stats.mozilla.com/report/list?signature=nsRootPresContext%3A%3ARequestUpdatePluginGeometry

Comment 1

[Marcia Knous [:marcia]]

I hit this on Mac today, loading http://laughingsquid.com/httpster-t-shirt/. I could reproduce a few times, and sometimes scrolling the page triggered the crash more easily.

http://crash-stats.mozilla.com/report/index/bp-b4182d55-1b3e-47a0-8693-8bf1f2120808

Some URLs on Mac and Linux:

2 	https://clanvv3.com/
1 	https://www.todaslastarjetas.com/pago-con-deposito-bancario-de-tarjetas-telefoni
1 	http://laughingsquid.com/httpster-t-shirt/
1 	https://crash-stats.mozilla.com/report/index/882d8a58-c1e4-4c17-8db4-68c92212080
1 	about:blank
1 	https://blu002.mail.live.com/default.aspx?id=64855&owa=1&owasuffix=owa%2f
1 	https://www.todaslastarjetas.com/panelAdmon.asp
1 	http://www.ecochorus.ftp.cc/

Comment 2

[Scoobidiver (away)]

According to comments, it seems related to outlook.com

Comment 3

[Marcia Knous [:marcia]]

I replicated this crash once on Win 7 visiting https://laughingsquid.com/page/2/ and scrolling the page, but wasn't able to reproduce again:

https://crash-stats.mozilla.com/report/index/60faef7f-f611-4b79-9e04-3019b2120809

Almost all URLs are Hotmail, but here are some others:

http://unfair.co/gaming/the-secret-world/the-secret-world-the-hunger-guide-solution/
http://www.ige.com/
http://www.animefushigi.com/full-anime-list
http://unfair.co/gaming/the-secret-world-mortal-sins-tier-16-17-18-19-20-21-guide-solution/
http://www.wilmaa.com/#/wilmaa/

Comment 4

[Marcia Knous [:marcia]]

Bug 745030 is in the regression range, so that may be related to the crashes.

Comment 5

[John Schoenick [:johns]]

It looks like we're incorrectly keeping subdocuments or plugins alive in some situations after bug 745030 - this could be the same as bug 781265.

Comment 6

[Ricardo Maçãs [:Ricmacas]]

According to the comments, it seems to be happening to most Outlook.com users. I just crashed twice there. https://crash-stats.mozilla.com/report/index/bp-255bbd34-6f3e-47fd-a63f-b27c42120811

Comment 7

[Marcia Knous [:marcia]]

I can reproduce this crash easily on Mac trunk, following these steps:

1. Using a previously created Hotmail address, go to http://outlook.com/ and upgrade your account.
(following instructions from http://blogs.office.com/b/microsoft-outlook/archive/2012/08/03/upgrade-from-hotmail-to-outlook-com.aspx)
2. After sign in, I crash every time.

http://crash-stats.mozilla.com/report/index/bp-28c750d2-a089-498b-8503-146bd2120812

Comment 9

[John Schoenick [:johns]]

The fix in bug 781265 may also fix this, but I have not been able to reliably reproduce this instance of it

Comment 11

[Scoobidiver (away)]

(In reply to John Schoenick [:johns] from comment #9)
> The fix in bug 781265 may also fix this, but I have not been able to
> reliably reproduce this instance of it
It's indeed a dupe according to recent crash stats.

Comment 12

[Tony Mechelynck [:tonymec]]

Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/17.0 Firefox/17.0 SeaMonkey/2.14a1 ID:20120818003004 c-c:8261f4f34dca m-c:812ea773f166

bp-4609033b-fb07-4e92-99d5-83bce2120818

Comment 15

[jon]

Just browse for a bit and don't know how to submit bug
I found that advertising is not completely shielding with Firefox
Advertising will be very card after the conflict，User experience very much

this:http://bbs.china-share.com